migrate falco deployment to operator

falco/falco-operator-values.yaml

@@ -0,0 +1,17 @@
+# Falco Operator settings. Falco instances and their artifacts are managed by
+# the CRs under falco/operator-resources.
+replicaCount: 1
+
+# Keep ArgoCD tracking labels on the operator itself, not on resources created
+# by the operator from Falco, Config, Plugin, or Rulesfile resources.
+excludedLabels:
+  - argocd.argoproj.io/instance
+  - argocd.argoproj.io/tracking-id
+
+resources:
+  requests:
+    cpu: 10m
+    memory: 64Mi
+  limits:
+    cpu: 500m
+    memory: 128Mi

falco/falco-values.yaml

@@ -1,6 +0,0 @@
-# Phase 2 placeholder values. Runtime rules and webhook output are added in
-# phase 5; keeping values in Git now establishes the ArgoCD ownership boundary.
-falco:
-  json_output: true
-  json_include_output_property: true
-

falco/operator-resources/falco-config.yaml

@@ -0,0 +1,12 @@
+apiVersion: artifact.falcosecurity.dev/v1alpha1
+kind: Config
+metadata:
+  name: falco-output
+  namespace: falco
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  priority: 50
+  config:
+    json_output: true
+    json_include_output_property: true

falco/operator-resources/falco-instance.yaml

@@ -0,0 +1,9 @@
+apiVersion: instance.falcosecurity.dev/v1alpha1
+kind: Falco
+metadata:
+  name: falco
+  namespace: falco
+  annotations:
+    # Apply the instance after the Operator chart has installed its CRDs.
+    argocd.argoproj.io/sync-wave: "1"
+spec: {}

falco/operator-resources/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - falco-instance.yaml
+  - falco-config.yaml

falco/operator-resources/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: falco